https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:37:06 +0000 https://cve.radiocsirt.org/vuln/cve-2025-61783 <p><strong>Affected:</strong> python-social-auth social-app-django</p> <p>Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> <p><strong>Affected:</strong> python-social-auth social-app-django</p> <p>Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> https://cve.radiocsirt.org/vuln/cve-2025-61783 https://cve.radiocsirt.org/vuln/ghsa-wv4w-6qv2-qqfg <p><strong>Affected:</strong> PyPI: social-auth-app-django</p> <p>### Impact</p> <p>Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses.</p> <p>### Patches</p> <p>* https://github.com/python-social-auth/social-app-django/pull/803</p> <p>### Workarounds</p> <p>Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> <p><strong>Affected:</strong> PyPI: social-auth-app-django</p> <p>### Impact</p> <p>Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses.</p> <p>### Patches</p> <p>* https://github.com/python-social-auth/social-app-django/pull/803</p> <p>### Workarounds</p> <p>Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-wv4w-6qv2-qqfg